21

We have often some issues in terms of interoperability on the Web. One of these issues for browsers vendors is the wrongly spelled Connection HTTP header. The most common errors are given by these two forms.

nnCoection:
Cneonction:

There are has been a few articles about this, including Fun with HTTP headers. Often it is happening by period, then disappear. It seems that some of them are created by load balancers such as this example: NetScaler Appliance.

Do you know any other instances of hardware or software that create these issues?

Update Here an example among others of a site which doesn't send back a good Connection HTTP header.

curl -sI ehg-nokiafin.hitbox.com
HTTP/1.1 200 OK
Date: Tue, 25 Jan 2011 20:35:45 GMT
Server: Hitbox Gateway 9.3.6-rc1
P3P: policyref="/w3c/p3p.xml", CP="NOI DSP LAW NID PSA ADM OUR IND NAV COM"
Cneonction: close
Pragma: no-cache
Cache-Control: max-age=0, private, proxy-revalidate
Expires: Tue, 25 Jan 2011 20:35:46 GMT
Content-Type: text/plain
Content-Length: 23

update 2011-01-26

On Amazon forum about AWS, there is a thread about nnCoection. A comment says:

FYI, the reason it misspells the word connection is so that the internet check-sum (a simple sum) still adds up, this way the change can occur at the packet level. If it completely removed the header, it would have to stall forwarding the response until the header was entirely read, so it could rewrite the headers, recompute the checksum and then send it along.

with

sum(ord(c) for c in "Connection")

and

sum(ord(c) for c in "nnCoection")

both gives 1040

karlcow
  • 6,781
  • 4
  • 34
  • 69

1 Answers1

10

Are you sure it's an actual issue? The linked article suggests that these sorts of headers are "misspelled on purpose" so that a load balancer, reverse proxy or other middlebox can defeat the server's wishes that the connection be kept alive, without having to track a delta in TCP stream position over the life of the connection. Something like this may actually be necessary to bring a downed and recovered server back into active duty, by forcing kept-alive connections to other servers to migrate to the one brought online.

If you have a protocol that's dependent on HTTP Connection: keep-alive to function (cough), you're probably doing it wrong.

Community
  • 1
  • 1
Jeffrey Hantin
  • 33,679
  • 7
  • 71
  • 92
  • in the case of the load-balancer, there is a second connection header. but there are many cases where nothing else is sent. I will edit the post to give an example. – karlcow Jan 25 '11 at 21:30
  • Looks good. I think these are misspelled by TCP load-balancers so that a) Clients will ignore them and b) They don't have to recalculate the checksum. This is a deliberate, although rather hackish way of doing it. I've seen it before in other cases. – MarkR Jan 25 '11 at 21:39
  • @MarkR Good point about the checksum. Both misspellings result from swapping adjacent 16-bit words, and which one is used is likely dependent on whether the initial C falls on a word boundary; since TCP uses a ones-complement checksum of 16-bit words, exchanging two 16-bit words will not invalidate the checksum. On the other hand, you probably won't see such shenanigans played with HTTPS. – Jeffrey Hantin Jan 25 '11 at 22:19
  • It's totally OK not to add another Connection header if you don't need to. – Mark Nottingham Feb 02 '11 at 23:37
  • 1
    Interesting, but gross. – Chris Moschini Jun 26 '14 at 20:27